Close AdGuard Home on VPS under nginx

[Gooman-rus]

I have installed AdGuard Home on VPS using this article.
Is there any simple way to close web admin panel of ADH using nginx without reinstalling ADH? I want to make ADH web admin panel be accessible only from certain IPs.
Or maybe ADH have an option to make admin panel be accessible from certain IPs?

[ammnt]

I have installed AdGuard Home on VPS using this article.
Is there any simple way to close web admin panel of ADH using nginx without reinstalling ADH? I want to make ADH web admin panel be accessible only from certain IPs.
Or maybe ADH have an option to make admin panel be accessible from certain IPs?

Try this:

location / {
    allow 144.71.53.82;
    allow 147.78.32.89;
    deny all;
    proxy_pass https://localhost:8443/;
    proxy_redirect / /;
    proxy_cookie_path / /;
}

[Gooman-rus]

Does it require to change port of ADH?
8443 is a custom port. Should I change it in yaml configuration file of ADH?

[ammnt]

Does it require to change port of ADH?
8443 is a custom port. Should I change it in yaml configuration file of ADH?

You can choose any port. I just give you a sample😙

[Gooman-rus]

I mean I have installed ADH using article. This article does not contain any instructions of how to set up ADH under nginx. Could you please provide more specific instructions of what I should change in yaml config to make it work?
For example, will DoH and DoT work without any additional steps if I change the port in yaml config?

[ammnt]

@Gooman-rus, NGINX will only proxy HTTP(S) traffic. It does nothing about DoT traffic. Since two applications can not work on the same port, in the YAML file you will need to change the port of the web panel and DoH to the other.

[Gooman-rus]

Your nginx config example will make nginx to allow only certain IPs to DoH service. But I wanted to restrict access only to ADH web panel.

[ammnt]

Your nginx config example will make nginx to allow only certain IPs to DoH service. But I wanted to restrict access only to ADH web panel.

It is not possible while web panel and DoH works on the same port 443. Wait while this feature request will be resolved:
#741

[emlimap]

Below is my nginx config. In my setup, I have Adguard Home HTTP port set to port 81 and have set allow_unencrypted_doh to true in Adguard home config so Nginx terminates SSL and do plain text to AGH running on same box.

location / {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Proxy-Connection $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Protocol $scheme;
    proxy_http_version 1.1;

    allow 1.2.3.4/32;
    deny all;
}

location /dns-query {
    proxy_pass http://127.0.0.1:81/dns-query;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Proxy-Connection $proxy_add_x_forwarded_for;
    proxy_set_header X-Real-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Protocol $scheme;
    proxy_http_version 1.1;
}